Responsibilities
- Own security outcomes for two to four named production areas and serve as the primary security owner for at least one area.
- Define baseline risk metrics and deliver measurable improvements against six- and twelve-month targets.
- Design and implement IAM and least-privilege policies, service-to-service trust, key lifecycle and KMS integrations, runtime telemetry and alerting, secure OTA update patterns, and hardened CI/CD pipelines with build artifact provenance.
- Threat-model and perform secure design reviews for services near the physical fleet, regulated workflows, and partner or customer interfaces.
- Lead vulnerability management from triage and exploitability analysis through prioritized remediation, staged verification, and regression prevention.
- Build and exercise incident-response playbooks, validate logging and auditability, and participate in postmortems and corrective-action tracking.
- Secure AI- and agent-assisted development and operations through approved patterns, guardrails, monitoring, and auditing.
- Convert external penetration-test and red-team findings into tracked engineering work with measurable closure criteria.
- Collaborate with SRE, platform, autonomy, embedded, field-operations, compliance, product, and operations teams to implement technical controls.
- Participate in incident response and assigned on-call coverage.
Requirements
- At least 8 years of experience building and operating security controls for large-scale production systems across application and cloud infrastructure.
- Hands-on engineering experience shipping automation or tooling in Python, Go, or a similar language, including integrations with AI tools and agentic security bots.
- Deep practical experience with cloud-native stacks, Kubernetes, containers, IAM, CI/CD, secrets management, logging and telemetry, and least-privilege service-to-service models.
- Prior ownership of vulnerability management, incident-response playbooks, and production verification processes.
- Experience threat-modeling and securing systems interfacing with physical systems, regulated workflows, or third-party partners, including embedded, teleoperation, field operations, or healthcare-adjacent data flows.
- Ability to define and track quantitative security metrics such as MTTD, MTTR, exploitable findings, and compliance audit readiness.
- Ability to act as a technical owner, influence engineering teams, prioritize trade-offs, and drive changes through production.
- Adversarial and skeptical approach to failure modes and abuse cases.
- Experience securing LLM or agentic tools, mitigating OWASP LLM risks, and addressing prompt injection, unsafe plugin or output handling, and agentic privilege misuse is strongly preferred.
- Experience across cloud infrastructure, web services, and embedded or autonomy systems, or building developer-friendly security platforms and paved-road tooling, is strongly preferred.
Benefits
- Hybrid work arrangement based in South San Francisco with frequent headquarters presence.
- Occasional travel to distribution centers and test sites.
- On-call participation when assigned.
- Equal opportunity workplace with diversity and inclusion commitments.
Tech Stack
Categories
About Zipline
Zipline was founded to create the first logistics system that serves all humans equally. Our aim is to solve the world’s most urgent and complex access challenges. Leveraging expertise in robotics and autonomy, Zipline designs, manufactures and operates the world’s largest automated delivery system. Zipline serves tens of millions of people around the world and is making good on the promise of building an equitable and more resilient global supply chain. From powering Rwanda’s national blood delivery network and Ghana’s COVID-19 vaccine distribution, to providing on-demand home delivery for Walmart and enabling leading healthcare providers to bring care into the home in the United States, Zipline is transforming the way goods move. By transitioning to clean, electric, instant logistics, we can decarbonize delivery, decrease road congestion, and reduce fossil fuel consumption and air pollution, while providing equitable access for billions of people. The technology is complex but the idea is simple: a teleportation service that delivers what you need, when you need it. Zipline is inspiring people, governments, and businesses to imagine what is possible when goods can move as seamlessly as information. To join the team, check out our career page: https://flyzipline.com/careers/